Skip to content

Connect to a BYOC database

This topic introduces how to configure network access and connect to a BYOC database using an SDK. Configure a network path from your application to the database and use database-user credentials to authenticate.

Prerequisites

  • The data plane and database are Running.
  • An Organization Owner or Project Admin configures network access.
  • Your application has a permitted public source IP or a VPC from which it can reach a private endpoint. For private access, have an AWS administrator prepare the VPC, subnets, security groups, and endpoint-creation permissions.
  • A database user with the permissions required by the application. See Manage database users.

Step 1. Configure network access

Select the BYOC organization, open its project, click the database, then go to Security → Network access. Choose a network method offered by the database.

Public access

  1. Open IP Allow List and enable public access with the toggle.
  2. Click + Add IP Addresses and add the application's actual public source IP or CIDR. Add Current IP Address uses your browser's public IP, which may differ from the application server's IP.
  3. Verify the required addresses appear in the allow list and wait for the public service to be ready before copying connection details.

Restrict the allow list to the required sources. Allow Access From Anywhere broadens database exposure and is unnecessary for most application connections.

Private access

  1. Open Private Endpoint. Under Create Private Link Service, click Create and wait for the service to be ready.
  2. Under Create Private Link Endpoint, fill your application VPC ID and subnet ID(s). Learn more opens the AWS VPC console to help you find these values.
  3. Copy the generated AWS CLI command, check its region, service name, VPC and subnets, and run it using the intended AWS account. Use this command to create the client endpoint once; you do not need to create the same endpoint separately in the console first.
  4. In the AWS VPC console, open Endpoints and verify that the endpoint is available. Check its security groups and DNS resolution from the application network. Use the client endpoint's DNS name for a private connection.

Network resources in your AWS account can incur AWS charges. See License and costs.

Step 2. Obtain database credentials

  1. Open the database's Basic → Overview page and click Connect.
  2. In Connect to your database, click Database Users to open database user management.
  3. Use an existing authorized database user, or have a database administrator create one for the application. Store its password securely. If a password is unavailable, use the documented password reset procedure.

Use the database username and password, not your Cloud account login, AWS profile, or role ARN. Grant the application's database user only the graph privileges it needs.

Step 3. Obtain the endpoint and connect

  1. Return to Basic → Overview and click Connect again after obtaining the database credentials.
  2. In Connect to your database, choose Public (Connect via public network) or Private (Connect via private endpoint) to match Step 1.
  3. Under Choose a client, select NebulaGraph Java, Go, or Python. Use the linked client documentation for installation and a connection example compatible with your database version.
  4. For public access, copy Host. For private access, follow the AWS Endpoint link and copy the client endpoint's DNS name. Copy Port from the dialog.
  5. Replace the SDK example's host, port, username, and password with these values. Run the example from the permitted application network.

Verify that authentication succeeds and that a query allowed for that user returns successfully. For a user authorized to list graphs, SHOW GRAPHS is a simple check; an empty graph list still indicates a successful query. If connection fails, distinguish timeout/DNS errors from authentication or privilege errors using Troubleshooting.